High severity · published Jun 25, 2026
CVE-2026-9650
CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses…
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this credential an attacker could subsequently compromise the device if they have physical access to the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller · Schneider Electric
Version 11.06.30 and prior · source: vendor
SD
Saitel DP Remote Terminal Unit & Controller · Schneider Electric
Version 11.06.35 and prior · source: vendor
ET
Easylogic T150 Firmware · Schneider-electric
before 11.06.32 · source: NVD
SD
Saitel DP Firmware · Schneider-electric
before 11.06.38 · source: NVD
Affected product
ET
EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9650
Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-02.pdf
More from EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
7.1
CVE-2026-6865
Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products
4.4
CVE-2026-9651
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an…